Qatar targeted by Chinese hackers amid Middle East conflict

Multiple China-nexus threat operations have launched cyberattacks against Qatar amid escalating tensions in the Middle East, according to HackRead.

Intrusions by Chinese advanced persistent threat operation Camaro Dragon that commenced on Mar. 1, just a day after the joint U.S.-Israel military strikes against Ukraine, involved the delivery of a file with photos showing the aftermath of an Iranian missile strike against a Bahrain-based U.S. military base, which triggered a DLL hijacking attack leading to the injection of the PlugX backdoor, a report from Check Point Research showed.

Another China-linked attack campaign aimed at Qatar's oil and gas sector entailed the distribution of a password-protected ZIP file detailing strikes against Gulf oil and gas facilities. Threat actors had concealed malicious code within a component of the legitimate open-source screen reader NVDA to deploy Cobalt Strike. Such a development comes after Iranian APT group MuddyWater was reported to have compromised U.S. organizations with the DinDoor malware.